[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.codehaus.mojo:license-maven-plugin (source)	2.8.0 → 2.9.0

---

Release Notes

mojohaus/license-maven-plugin (org.codehaus.mojo:license-maven-plugin)

v2.9.0

Compare Source

License Maven Plugin 2.9.0 caches downloaded license texts between builds, adds name-based URL overrides and stricter download checks, and fixes a long list of reported bugs in headers, the third-party report and dependency resolution. The requirements are unchanged: Maven 3.9.0 or later, Java 8.

⚠️ Changes to check when upgrading

• -Dlicense.licenceFile is now -Dlicense.licenseFile for update-project-license and check-project-license. The misspelled property still works for now, with a deprecation warning (#​797, #​479 by @​zdenek-jonas).
• verbose is deprecated. Its messages are logged at debug level, so use -X instead (#​810, #​340 by @​digulla).

✨ Highlights

• License texts are cached between builds in ${settings.localRepository}/.cache/mojohaus-license-maven-plugin and reused for 30 days, then revalidated with ETag/Last-Modified. CI builds that restore the local repository stop downloading the same license pages on every run (#​780).
• licenseNameUrlOverrides downloads a license text from a URL you choose, matched by a regular expression on the license name, so variants of one license share a clean text (#​718 by @​MrBanana05).
• Stricter downloads. failOnForbidden fails the build when a dependency has a license listed in forbiddenLicenses (#​792, #​323 by @​ppalaga), and failOnMissingLicenseFile fails it when a license text could not be downloaded (#​791). HTML pages are no longer accepted as license texts (#​790).
• Dependency POMs are read from the repositories of the POMs that lead to them, so licenses of dependencies hosted outside the project's repositories are no longer "Unknown" (#​807, #​752 by @​lrozenblyum).
• The third-party report links each license to its URL (#​799, #​212 by @​digulla).
• Proxy: every download of the plugin now uses the active Maven proxy (#​804, #​434 by @​lexx9999).
• File headers: the FreeMarker directive stays first when a header is added (#​806, #​412 by @​smokemaker). Blank lines of the license are kept when an existing header is read (#​808, #​347 by @​heapifyman). The package statement is no longer matched inside comments (#​803, #​562 by @​onacit). Files fall back to LF when no file sets the end of line (#​800, #​511 by @​jacek-lewandowski).
• Other fixes: relative file: URLs of license texts resolve against the base directory (#​809, #​428 and #​431 by @​duracotton). The third-party file is added to the resources whatever its name (#​796, #​124 by @​bnese), and the template can read the project (#​801, #​365 by @​ST-DDT). A missing classpath license repository fails with a clear error (#​802, #​384 by @​HenningL), and unknown missing-file entries are logged at debug level when the file is remote (#​798, #​201 by @​TorstenKruse). The artifact cache no longer leaks between helper instances (#​793, #​375 by @​cwholmes), and the dead EUPL 1.1 header URL is replaced (#​795, #​443 by @​dodinh).
• overrideFile is no longer deprecated. It is the choice for a file inside the project, and overrideUrl stays for remote and classpath: locations (#​794, #​416 by @​bogdanb).
• Documentation moved to Markdown (#​783), and says that includes and excludes are relative to the roots (#​805).

🚀 New features and improvements

• Reject HTML responses as license texts (#​790) @​slachiewicz
• Cache downloaded license texts between builds (#​780) @​slachiewicz
• Add failOnMissingLicenseFile to the download goals (#​791) @​slachiewicz
• Scope the artifact cache of DefaultThirdPartyHelper to the helper (#​793) @​slachiewicz
• Remove the deprecation of the overrideFile parameter (#​794) @​slachiewicz
• Add failOnForbidden to the download goals (#​792) @​slachiewicz
• Feat: Allow easier Reusing / Normalization of License Texts (#​718) @​MrBanana05

🐛 Bug Fixes

• Read dependency POMs from the repositories of the POMs that lead to them (#​807) @​slachiewicz
• Link licenses to their URL in the third-party report (#​799) @​slachiewicz
• Log the verbose messages at debug level and deprecate verbose (#​810) @​slachiewicz
• Replace the dead URL in the EUPL 1.1 header (#​795) @​slachiewicz
• Use the active proxy for the other downloads of the plugin (#​804) @​slachiewicz
• Add the third-party file to the resource directory regardless of its name (#​796) @​slachiewicz
• Fall back to LF when no file can set the end of line (#​800) @​slachiewicz
• Rename the licenseFile property to license.licenseFile (#​797) @​slachiewicz
• Resolve relative file URLs of license texts against the basedir (#​809) @​slachiewicz
• Keep the ftl directive first when adding a file header (#​806) @​slachiewicz
• Keep blank lines of the license when reading an existing header (#​808) @​slachiewicz
• Log unknown missing file entries at DEBUG when the file is remote (#​798) @​slachiewicz
• Expose the project to the third-party file template (#​801) @​slachiewicz
• Fail with a clear error when a classpath license repository is missing (#​802) @​slachiewicz
• Anchor the package statement search outside comments (#​803) @​slachiewicz

📝 Documentation updates

• Document that includes and excludes are relative to the roots (#​805) @​slachiewicz
• Convert the site documents to Markdown (#​783) @​slachiewicz

👻 Maintenance

• Remove license headers from invoker.properties fixtures (#​788) @​slachiewicz
• Declare the plugin version inline in fixtures that need no pluginManagement (#​789) @​slachiewicz
• Assert what the licence whitelist and blacklist ITs claim (#​787) @​slachiewicz
• Move the download error report out of AbstractDownloadLicensesMojo.execute() (#​785) @​slachiewicz

🔧 Build

• Resolve the site fixture's plugins in the main build (#​786) @​slachiewicz
• Reuse the cached prefix file in the integration tests (#​784) @​slachiewicz

Thanks to @​MrBanana05, @​slachiewicz and Bjarne Cornelius.

Full changelog

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7349

[gitar-bot]

CI failed: One test failure in the scanner integration tests (it-java-scanner-integration-tests) caused the Maven build to fail; the log omits the specific failing test, and the finding is judged unrelated to this license-maven-plugin bump.

Overview

The build failed from a single unique error template across 1 analyzed log (commit 29775aa). The Maven reactor failed in its/scanner-integration-tests (it-java-scanner-integration-tests) because Surefire reported test failures. The failing test names and their error messages are not present in the supplied log.

Failures

Surefire test failure in it-java-scanner-integration-tests (confidence: medium)

• Type: test
• Affected jobs: 132649236719
• Related to change: no
• Root cause: Surefire failed in it-java-scanner-integration-tests and the build stopped (BUILD FAILURE, Failed to execute goal maven-surefire-plugin:test). The individual test failure details are not included in the excerpt. The PR only changes the license-maven-plugin version in sonar-java-plugin/pom.xml, and nothing in the log links that change to this module's tests.
• Suggested fix: Inspect its/scanner-integration-tests/target/surefire-reports and any Surefire dump files to identify the failing test and its cause, then fix or update that test as appropriate. The supplied log does not support a more specific fix.

Summary

• Change-related failures: None. The single failure is marked unrelated to the PR.
• Infrastructure/flaky failures: None identified. The failure is not classified as flaky, though the log lacks enough detail to rule out a flaky test.
• Recommended action: Pull the Surefire reports for it-java-scanner-integration-tests from the job artifacts to get the failing test and error, then decide whether it is a pre-existing failure or a flaky test. The license-maven-plugin bump itself does not appear to be the cause based on this log.

Code Review ✅ Approved 🟡 Medium risk

Upgrading the license Maven plugin changes build-time license checks and downloads, which could alter generated headers or fail builds under stricter validation.

Bumps the org.codehaus.mojo:license-maven-plugin dependency from 2.8.0 to 2.9.0, a Renovate update with no open findings. No issues found.

Verification Rules 2/2 met PRs 2 inspected

Functional validation No results

Rules 2 passed 2 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 6520: Update dependency org.codehaus.mojo:exec-maven-plugin to v3.7.0 Inspected
PR 678: Update dependency org.codehaus.mojo:license-maven-plugin to v2.9.0 Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[datadog-sonarsource]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Build | Test Analyze

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 29775aa | Docs | View more details | Give us feedback!}